Reporting period: 1 June to 1 September 2026
Contents
Executive Summary
Between June and August 2026, MTI’s Security Operations Centre (SOC) recorded 2,007 incident records, providing valuable insight into the cyber threats organisations are facing and how attackers are evolving their techniques.
Phishing and identity compromise remained recurring themes, with investigations revealing how attackers can exploit legitimate authentication processes, register unauthorised devices and manipulate mailbox rules to maintain access or conceal their activity. Other investigations identified ClickFix-style social engineering attacks, malicious files introduced through automated downloads and exposed services protected by weak credentials. Emerging AI security risks also came into focus, including an alert involving suspected prompt injection targeting an AI agent, although no successful exploitation was identified.
Building on the identity, email and web threats explored in MTI’s Q1 SOC Insights report, this edition takes a closer look at what happens beyond the initial attack and the challenges organisations face in detecting, containing and recovering from security incidents.
The findings reinforce an important message: detecting or blocking a threat is only the beginning. Effective cyber resilience requires visibility across email, identity, endpoints and applications, alongside the expertise and processes to understand what happened, contain remaining risks and prevent further compromise.
Drawing on real-world SOC investigations, this report explores the latest findings and provides practical recommendations to help organisations strengthen identity security, improve phishing protection, manage emerging AI risks and build more effective incident response capabilities.
Key Finding at a Glance
2,007 SOC incident records | 165 user-reported malware or phishing email incidents | 15 potentially malicious URL-click incidents. These categories are not additive.
The investigations highlight three priorities: contain identity compromise beyond password resets; investigate browser-based social engineering beyond the first blocked request; and govern AI agents with clear permissions, monitoring and data-access boundaries.
MTI SOC Activity Snapshot
MTI’s SOC recorded the following activity between June and August 2026. The categories below describe different measures and should not be added together.
|
Activity |
Incidents |
|
SOC incident records |
2,007 |
|
User-reported malware or phishing email incidents |
165 |
|
Potentially malicious URL-click incidents |
15 |
Recurring investigation themes included suspicious sign-ins, changes to accounts and authentication methods, malicious web destinations, unwanted downloads and post-delivery email remediation. Investigations required correlation across email, identity, endpoint and network telemetry to establish the outcome and the action needed.
Key Findings from SOC Investigations
1. Identity Compromise: Why Password Resets Are Not Always Enough
A confirmed device-code phishing attack resulted in account compromise and registration of an unauthorised device. Defender automatically disabled the account, and remediation included credential recovery, MFA re-registration and removal of the device. Related investigations identified continued failed access attempts associated with a suspicious registered device after credentials had been reset.
A separate mailbox compromise involved a fake Microsoft login page and user-approved MFA. The attacker sent further phishing emails and created an inbox rule designed to hide incoming messages. This demonstrates why recovery must include mailbox configuration, authentication methods and device registrations alongside sign-in history.
The mailbox investigation also identified a detection gap: a rule limited to selected consumer VPN providers did not cover the infrastructure used for the suspicious rule creation. Organisations should detect the behaviour itself and use source reputation as supporting context, correlating unfamiliar access with mailbox changes and unusual outbound email.
2. ClickFix Attacks and Browser-Based Social Engineering
MTI investigated ClickFix-style activity involving fraudulent CAPTCHA prompts and suspicious changes to Windows Run history. Endpoint and firewall controls blocked associated malicious requests, and investigations recorded containment with no further detections from precautionary scanning.
The key response question is whether the user pasted or executed a command. Analysts need to examine browser activity, process execution, scripts and persistence indicators, as well as the blocked destination. A clean scan or blocked URL should be considered alongside this evidence when assessing the device.
3. Malicious Files Entering Through Operational Processes
An automated data collection process retrieved a PHP webshell from an external source confirmed to be compromised. Endpoint protection quarantined the file on write, with no execution identified. Unexpected files were removed, and remediation addressed both the receiving systems and the external source.
In another case, weak test credentials allowed an attacker to authenticate to an exposed SFTP service and upload cryptominer files. Defender quarantined the uploads, and restrictions on the account prevented execution. The test accounts were removed, with no evidence of mining activity.
These cases highlight the importance of controlling how files enter server environments. Approved feeds need content validation and defined file-handling rules. Internet-facing services need strong authentication, restricted access and removal of unused accounts.
4. AI Agent Security and Application Governance
An alert involving Microsoft 365 Copilot Researcher flagged suspected prompt injection within a tool response. The investigation found no indication of successful exploitation. A separate investigation involved an AI application prohibited by customer policy, which endpoint controls blocked.
These investigations expose different requirements: governing which AI applications are approved and establishing whether external content influenced an approved agent. Organisations need visibility of relevant interactions and subsequent actions, supported by clear permissions and data-access boundaries.
Emerging Threat Trends to Watch
1. Prompt Injection Through Retrieved Content
An AI agent can encounter hostile instructions embedded in webpages, documents or tool responses. Microsoft’s guidance recommends constraining connected tools and service identities to limit the consequences of a compromised interaction. CrowdStrike research describes fragmented instructions, imitation of control boundaries and instructions activated by a later trigger.
For organisations adopting AI agents, security testing should cover retrieved content and tool outputs, while monitoring should establish whether suspicious instructions resulted in an unauthorised action. MTI’s Copilot investigation illustrates this monitoring requirement without establishing successful manipulation or data loss.
2. ClickFix Attacks and Wider Intrusion Risks
Microsoft’s TerminalFix research describes fake Cloudflare verification prompts that persuade users to execute PowerShell, followed by DLL sideloading, persistence, reconnaissance and a reverse tunnel. MTI’s cases have not been attributed to that campaign, but the research shows why fake verification activity warrants investigation beyond the first blocked connection.
3. Social Engineering Beyond Email
Microsoft’s Q2 2026 threat research reported growth in Teams-based voice phishing and campaigns using calendar invitations. Companies should include suspicious chats, calls and invitations in awareness programmes, reporting routes and SOC monitoring. Requests involving credentials, authentication approval or software installation should be verified through a known contact channel.
Security Recommendations
The observed investigations highlight practical measures organisations can take to reduce phishing exposure, restrict unsafe access and contain compromise quickly. The controls below should be prioritised according to risk, licensing, business requirements and technical feasibility.
1. Strengthen identity controls and recovery
Prioritise phishing-resistant MFA for privileged and high-risk access. Audit device-code authentication and restrict it where unnecessary, testing business dependencies and policy impact before enforcement. Microsoft recommends retaining only documented and secured uses. Review who can register devices and change authentication methods.
Test response procedures for password reset, authentication-method review, device removal and mailbox cleanup. Confirm that the SOC has the agreed authority and permissions to take containment actions and verify their completion.
2. Require compliant devices for organisational access
Require devices accessing corporate email and applications to be enrolled in Intune and meet assigned compliance policies. Where personal-device access is permitted, provide an approved enrolment route, such as Company Portal, with clear BYOD and privacy requirements. Entra registration alone does not establish that a device is managed or compliant.
Define platform-appropriate standards for supported operating systems, screen-lock protection, encryption and acceptable device risk, including checks for rooted or jailbroken mobile devices where supported. Mark devices with no assigned compliance policy as noncompliant.
Use Conditional Access to require the device to be marked as compliant for the relevant services. Test in report-only mode before enforcement and maintain controlled emergency-access exclusions. Devices that fail these requirements should be blocked; users whose personal devices cannot be enrolled should use an approved corporate device. Compliance controls access to corporate services, while awareness and phishing-resistant MFA remain necessary against phishing opened in a personal browser.
3. Limit session exposure and automate revocation
Set risk-appropriate Conditional Access sign-in frequency and browser-persistence controls, with stricter requirements for sensitive access. Sign-in frequency controls reauthentication; it is not an immediate expiry timer for every access token. Test application behaviour and avoid excessive prompts that encourage careless MFA approval.
Implement approved SOC playbooks that automatically revoke Entra sign-in sessions when high-confidence account-compromise detections fire. Revocation invalidates refresh tokens and Entra session cookies; combine it with account restriction and credential recovery where required. Use least-privilege permissions, log each action and escalate failures. A reported email or URL click alone should trigger investigation rather than automatic revocation in every case.
Validate Continuous Access Evaluation support so supported services can reject access after critical events without waiting for normal token expiry. Existing access tokens may remain usable until expiry where this is unsupported, and application-issued sessions can require separate termination. Verify containment across the affected applications.
4. Improve phishing protection and user reporting
Apply layered email protection, including impersonation controls, attachment and URL inspection, and post-delivery remediation where supported. Enable Outlook’s built-in Report phishing option and configure a monitored SecOps reporting mailbox and Defender submissions workflow. Enable Teams reporting in both Teams and Defender settings, including suspicious messages and calls where supported. Route reports and alerts to the SOC and provide user feedback.
Publish one clear reporting process. Users should report suspicious content without forwarding it to colleagues or opening it again. Anyone who entered credentials, approved an unexpected MFA request or executed a command should contact the service desk or SOC immediately and identify the device used, including any personal phone.
5. Automatically remediate malicious email clusters
For organisations with Defender for Office 365 Plan 2, MTI recommends enabling AIR automated remediation for Similar files, Similar URLs and Multiple similar attributes, using Soft delete. When an automated investigation identifies an eligible malicious cluster, related messages in user mailboxes can be removed without waiting for manual SOC approval. This reduces the time recipients can interact with other copies of the same threat.
Review completed actions in the Defender Action center and validate whether recipients clicked links, entered credentials or downloaded content before removal. Clusters larger than 10,000 messages, failed or incomplete actions, and associated identity or endpoint activity continue to require SOC review. Verify incident tracking through the organisation’s Sentinel and service-management integrations.
Soft-delete recovery depends on Exchange Online retention settings. Configure the reporting mailbox as a SecOps mailbox in the Advanced delivery policy so evidence copies are excluded from AIR cluster remediation. Automated removal complements investigation and account containment; it does not undo credential exposure or command execution that has already occurred.
6. Run regular phishing simulations
Run safe, realistic simulations using Defender for Office 365 Attack simulation training where licensed, or an equivalent platform. Include credential-harvesting, attachment, document-sharing and QR-code lures where supported, reflecting the threats users encounter. Track reporting rates and time to report alongside clicks, credential submission and training completion. Use results for targeted education and repeat testing to assess improvement.
7. Reduce QR-code phishing risk on personal devices
Scanning a QR code from a work email on an unmanaged personal phone can move the interaction outside the organisation’s managed browser and endpoint protections, reducing SOC visibility. Users may still expose work credentials or approve authentication from that phone. Teach users to treat QR codes like untrusted links, use approved managed devices for work activity and report suspicious interactions on personal devices promptly.
8. Control browser downloads and script execution
Manage browser policies and extensions centrally. Apply application controls and script restrictions appropriate to the estate, and validate monitoring of PowerShell, unexpected process launches and persistence changes. Teach users to report webpages that ask them to paste commands into Run, Terminal or PowerShell.
9. Govern AI agents and connected tools
Use the Microsoft 365 admin centre to inventory available agents, identify owners and control availability to approved users or groups. Establish approval criteria covering purpose, permissions, knowledge sources, external tools and data classification. Review shared, externally published and ownerless agents, blocking or removing those without a valid business requirement. These foundational controls provide a starting point without requiring every organisation to purchase premium Agent 365 capabilities immediately.
Use Microsoft Agent 365 premium capabilities for enhanced activity visibility, policy templates, tool-access controls and integrated identity, security and compliance protection across supported agents. Validate the capabilities and licensing required for the organisation’s users and agent types, and test agents against hostile instructions in retrieved content.
Configure Microsoft Purview to protect the information agents use and disclose. Review overshared SharePoint content, apply sensitivity labels and appropriate Data Loss Prevention policies, and use Data Security Posture Management to identify exposure risks. Enable auditing and retain supported interactions for investigation and eDiscovery within agreed privacy and retention controls. An approved agent still needs appropriately restricted access to its underlying data.
Deploy the Microsoft Copilot data connector for Microsoft Sentinel to bring supported Copilot audit activity into SOC investigations. Validate ingestion, retention and SOC access to the records. Correlate available user, agent and resource activity with identity events, data-protection signals and Defender alerts. Use this evidence to investigate whether hostile content led to unauthorised actions, and test the hunting and detection coverage supported by the connector.
The Value of SOC Visibility
MTI’s investigations connected signals that individual alerts could not fully explain. Email and identity evidence established account compromise and mailbox abuse. Endpoint telemetry and service configuration explained why malicious uploads did not execute. Validation of an external source identified how a webshell entered an approved operational workflow.
This visibility allows organisations to move from reacting to an alert towards understanding the access obtained, the impact prevented and the weakness that needs to be addressed. It also helps security teams apply the same investigation discipline to emerging risks such as AI agents.
For organisations, the priority is to turn detection into effective response. Connected telemetry, tested response permissions and complete recovery checks help the SOC contain threats and translate investigation findings into lasting improvements.
Can your security team connect a suspicious sign-in with an unauthorised device or mailbox rule? Can it establish whether a fake verification prompt led to command execution, or whether an AI agent acted on hostile content? Speak to MTI’s cyber security specialists to review your monitoring coverage and response capability.
About The Author
Josh King is a cyber security leader at MTI with more than twelve years’ experience across managed services, security operations, and cyber defence. As head of MTI’s UK Security Operations Centre (SOC), he leads teams responsible for protecting organisations against an increasingly complex threat landscape. Combining deep technical expertise with hands-on leadership, Josh helps organisations strengthen their cyber resilience through proactive threat detection, incident response, and security best practices.